-
Notifications
You must be signed in to change notification settings - Fork 444
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Network Beaconing Identification] Update beaconing docs to add feature details of the transform #8518
Conversation
@@ -1,6 +1,6 @@ | |||
dest: | |||
index: ml_beaconing-1.0.0 | |||
pipeline: 1.0.0-ml_beaconing_ingest_pipeline | |||
index: ml_beaconing-1.1.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Out of curiosity, does this transform ever need unattended setting?
https://www.elastic.co/guide/en/elasticsearch/reference/current/put-transform.html
(Optional, boolean) If true, the transform runs in unattended mode. In unattended mode, the transform retries indefinitely in case of an error which means the transform never fails. Setting the number of retries other than infinite fails in validation. Defaults to false.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @qn895 we are looking into adding that flag for beaconing, but not just yet as we want to see how it's faring on LMD; https://github.com/elastic/security-team/issues/7922#issuecomment-1812819516
I think as soon as the ES change you linked has gone out then it should be safe to update
Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com>
Package beaconing - 1.1.0 containing this change is available at https://epr.elastic.co/search?package=beaconing |
What I did in this PR
Updated the README to add feature details and customizations from this HTML page. The HTML will be deleted after this PR is merged.
Checklist
changelog.yml
file.Screenshots
Screenshots are in the comment section